# Gridview Postback data triggering XSS attack rule in firewall

**URL:** <https://forum.dotvvm.com/t/gridview-postback-data-triggering-xss-attack-rule-in-firewall/258>\
**Category:** Discussion in English\
**Created:** [September 8, 2024, 11:58pm UTC](https://forum.dotvvm.com/t/gridview-postback-data-triggering-xss-attack-rule-in-firewall/258 "2024-09-08T23:58:05Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![krishna\_logss](https://forum.dotvvm.com/letter_avatar_proxy/v4/letter/k/67e7ee/32.png) [@krishna\_logss](https://forum.dotvvm.com/u/krishna_logss)\
**Post date:** [September 8, 2024, 11:58pm UTC](https://forum.dotvvm.com/t/gridview-postback-data-triggering-xss-attack-rule-in-firewall/258/1 "2024-09-08T23:58:05Z")

</div>

I have gridview data that have some contents in html. Problem is when the data is sent back for postback, the firewall is triggering XSS rule. What’s the best way to handle this.

---

<div class="post-metadata">

**Author:** ![exyi](https://forum.dotvvm.com/user_avatar/forum.dotvvm.com/exyi/32/9_2.png) [@exyi](https://forum.dotvvm.com/u/exyi)\
**Post date:** [September 9, 2024, 12:28pm UTC](https://forum.dotvvm.com/t/gridview-postback-data-triggering-xss-attack-rule-in-firewall/258/2 "2024-09-09T12:28:11Z")

</div>

I don’t know, it seems like a misconfigured WAF to me. I guess you might be able to workarounding by marking the property with HTML content as `[Bind(Direction.ServerToClient)]`.

---

<div class="post-metadata">

**Author:** ![krishna\_logss](https://forum.dotvvm.com/letter_avatar_proxy/v4/letter/k/67e7ee/32.png) [@krishna\_logss](https://forum.dotvvm.com/u/krishna_logss)\
**Post date:** [September 10, 2024, 5:26am UTC](https://forum.dotvvm.com/t/gridview-postback-data-triggering-xss-attack-rule-in-firewall/258/3 "2024-09-10T05:26:08Z")

</div>

Most of the HTML Content are binded to Gridviews. Also can’t mark Gridview as `[Bind(Direction.ServerToClient)].` as it needs the postback data for sorting and paging.

---

<div class="post-metadata">

**Author:** ![exyi](https://forum.dotvvm.com/user_avatar/forum.dotvvm.com/exyi/32/9_2.png) [@exyi](https://forum.dotvvm.com/u/exyi)\
**Post date:** [September 11, 2024, 4:20pm UTC](https://forum.dotvvm.com/t/gridview-postback-data-triggering-xss-attack-rule-in-firewall/258/4 "2024-09-11T16:20:58Z")

</div>

Well, I though you could mark as ServerToClient the single property with HTML content. If you need the HTML content back on the server, there logically aren’t many more options than reconfiguring the WAF. Although, if you are relying the HTML content from the client, I’d understand if your security would get quite nervous